diff --git a/vpn-node/Dockerfile b/vpn-node/Dockerfile
index f7f75c7..290e3ea 100644
--- a/vpn-node/Dockerfile
+++ b/vpn-node/Dockerfile
@@ -37,12 +37,23 @@ RUN curl -fsSL https://apps.purevpn-tools.com/cross-platform/linux-cli/productio
     && bash /tmp/cli-install.sh \
     && rm -f /tmp/cli-install.sh
 
-# ── Pre-download pured daemon (avoids runtime download which 403s) ────────────
-# The binary hardcodes the wrong S3 path; the correct URL is in the installer.
+# ── Pre-download pured daemon + patch wrong URL in purevpn-cli binary ────────
+# The binary hardcodes /cross-platform/linux-cli/production/pured-linux-x64.gz
+# which returns HTTP 403. The correct URL (from the installer script) is under
+# /cross-platform/linux-daemon/1.4.1/. Same-length replacement (54 bytes each).
 RUN curl -fsSL "https://apps.purevpn-tools.com/cross-platform/linux-daemon/1.4.1/pured-linux-x64.gz" \
         -o /opt/purevpn-cli/pured-linux-x64.gz \
     && gzip -d /opt/purevpn-cli/pured-linux-x64.gz \
     && chmod +x /opt/purevpn-cli/pured-linux-x64
+RUN python3 -c "
+data = open('/opt/purevpn-cli/bin/purevpn-cli','rb').read()
+old = b'cross-platform/linux-cli/production/pured-linux-x64.gz'
+new = b'cross-platform/linux-daemon/1.4.1/pured-linux-x64.gz?x'
+assert len(old)==len(new), f'{len(old)} vs {len(new)}'
+n = data.count(old); assert n > 0, 'pattern not found'
+open('/opt/purevpn-cli/bin/purevpn-cli','wb').write(data.replace(old,new))
+print(f'Patched {n} occurrence(s)')
+"
 
 # ── Fake systemctl (pured.service) ───────────────────────────────────────────
 # purevpn-cli checks `systemctl is-active pured.service` to detect missing